1. Field of the Invention
The invention generally relates to a system and method of providing credentials in a network, in particular, providing short living credentials to a target application without using persistent memory.
2. Background Description
Providing friendly and simplified access to networks may often be at odds with providing protection of a user's identity and password(s). Security breaches have become a significant problem in networks when fraudulent acquisition of users' identities and passwords occurs. Fraudulent access to network resources has caused a plethora of damage which has forced network and application providers to increase security methods and measures.
Spoofing a user's identity has been a constant threat and often occurs while an authentic user is accessing a network resource. When authentication parameters are in the process of being analyzed and/or validated, an opportunity may exist for a security breach. Avoiding a security breach and detecting when a security breach has occurred has been an ongoing endeavor. However, security breaches are still prevalent.
For example, in a network system, to provide single sign on (SSO) functionality, a portal server may need to submit a user's ID and password to other applications. Storing the user's confidential information in a persistent storage inherently poses a security threat since the information would be present for potential unauthorized access.
Furthermore, many security standards require that passwords are not stored in non-persistent memory longer than it is absolutely necessary to perform the user authentication, i.e., password image in memory must be destroyed immediately after its has been used. Thus, even in the case when the target application (TA) uses the same information as those used by the portal, and the logon to the TA does not happen immediately after logon to the portal, but rather at the time of the end user's choosing, to provide a secure SSO mechanism, a solution without storing user's information in memory is highly desirable.
Creation of a security process that avoids inordinate exposure of a user's confidential password to downstream network resources would be a desirable improvement to network security. Further, if authentication of a user during significant stages of network access is capable of detecting a fraudulent use of a user's information, then an increase in overall security may be achieved.